Set no-store during request creation

[linkdata]

Summary

Page metadata carries a one-use Request key. Replaying a cached response reuses the consumed key, so the page cannot establish another WebSocket connection.

• make Jaws.NewRequest accept the page response writer and replace Cache-Control with no-store before request construction or rendering
• pass the real response writer through ui.Handler, jawstest, examples, tests, benchmarks, and the request exercise script
• document that HeadHTML does not modify response headers
• add a regression that commits body bytes before HeadHTML and verifies the committed response still contains exactly one no-store directive

Compatibility

This is a source-breaking API change:

// Before
rq := jw.NewRequest(r)

// After
rq := jw.NewRequest(w, r)

Callers must pass the response writer used for the page and call NewRequest before writing response headers or body. NewRequest replaces any existing Cache-Control value; calling it after the response is committed cannot change the sent headers.

Verification

• JAWS_REQUIRE_NODE=1 go test -race ./...
• JAWS_REQUIRE_NODE=1 go test ./...
• go vet ./...
• go build ./...
• staticcheck ./...
• golangci-lint run
• gosec ./...
• gofumpt -l .
• git diff --check